Health record rights in Kentucky: what state law adds
In Kentucky, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; you can opt out of the health information exchange; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices need not cover medical or health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
KCDPA in force 1 Jan 2026 requires opt-in consent for sensitive data, which includes mental or physical health diagnosis. AG enforces. A 2026 amendment effective 1 July 2027 adds smart TV content data; it does not change health terms.
Kentucky Consumer Data Protection Act: controller duties (sensitive data consent). KRS 367.3617(1)(e)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers
Kentucky Consumer Data Protection Act: definition of sensitive data. KRS 367.3611(28)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
"Sensitive data" means a category of personal data that includes: (a) Personal data indicating racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
Who it binds, in our words: Same thresholds as KRS 367.3613(1). KRS 367.3613(2)(c) excludes any "Covered entity or business associate governed by the privacy, security, and breach notification rules" under HIPAA.
Kentucky Consumer Data Protection Act: application and exemptions. KRS 367.3613
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data.
Who it binds, in our words: Alternative threshold in KRS 367.3613(1)(b). Exempt: nonprofit organizations, institutions of higher education, state agencies, HIPAA covered entities and business associates, protected health information and health records.
Genetic Information Privacy Act: direct-to-consumer genetic testing companies. KRS 311.705(2)(b)2.
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Separate express consent for transferring or disclosing the consumer’s genetic data to any person other than the company’s vendors and service providers, or for using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses;
Who it binds, in our words: Direct-to-consumer genetic testing companies. Does not apply to protected health information collected by a HIPAA covered entity or business associate.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Free first copy, paper or electronic, goes beyond HIPAA and 45 CFR 171.302. KRS 422.317 sets no deadline. 2026 HB 51 would end the free copy; it was not enacted.
Free copy: First copy of the patient's medical record on the patient's written request, from a licensed hospital or a health care provider
Fee rule: KRS 422.317(1): "A copying fee, not to exceed one dollar ($1) per page, may be charged by the health care provider for furnishing a second copy of the patient's medical record"
Goes beyond the federal floor: yes.
Copy of patient's medical record to be supplied on patient's written request. KRS 422.317
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Upon a patient's written request, a hospital licensed under KRS Chapter 216B or a health care provider shall provide, without charge to the patient, a copy of the patient's medical record.
Who it binds, in our words: Hospitals licensed under KRS Chapter 216B and health care providers. The Department of Corrections is not a health care provider under this section.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
Opt-out. Your records go through the exchange unless you say no, and there is a published way to say no.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
900 KAR 9:010 sets up KHIE but is silent on patient consent. Value comes from the published KHIE policy, which has no date; effectiveDate shows the date it was read as current. Part 2 SUD data needs opt-in.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: Kentucky Health Information Exchange (KHIE), operated by the Cabinet for Health and Family Services, Office of Health Data and Analytics, Division of Health Information.
Some sensitive records need your consent even where routine records do not.
KHIE Consent Model and Opt-Out Policy. KHIE Consent Management policy page
KHIE, the Kentucky Health Information Exchange, adopted the Opt-Out policy which means a patient's health information can be included in KHIE unless the patient chooses to opt out
Who it binds, in our words: Patients whose providers participate in KHIE. Opt-out form published at https://khie.ky.gov/Resources/Pages/KHIE-Consent-Model.aspx
KHIE Consent Management Tool for substance use disorder data. KHIE Consent Management Tool page
Patients provide electronic signatures to opt in to share 42 CFR Part 2 protected health information.
Who it binds, in our words: Substance use disorder records protected by 42 CFR Part 2
Kentucky Health Information Exchange participation. 900 KAR 9:010
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
the Office of Health Data and Analytics, Division of Health Information (DHI) has implemented the Kentucky Health Information Exchange (KHIE).
Who it binds, in our words: Health care providers that participate in KHIE
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The rule found covers abortion reports to the state. It bars patient names and identifiers in the report. No rule found on disclosure of reproductive care records held by providers.
Abortion required to be reported to Vital Statistics Branch: report contents. KRS 213.101(3)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
The report shall not contain: (a) The name of the pregnant patient; (b) Common identifiers such as a Social Security number and motor vehicle operator's license number; and (c) Any other information or identifiers that would make it possible to ascertain the patient's identity.
Who it binds, in our words: Abortion reports to the Vital Statistics Branch
Use of induced termination of pregnancy reports. KRS 213.106
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
The reports required under KRS 213.101 are statistical reports to be used only for medical and health purposes and shall not be incorporated into the permanent official records of the system of vital statistics.
Who it binds, in our words: Reports required under KRS 213.101
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
KRS 210.235 covers state mental health program records held by the Cabinet. It allows disclosure with consent, for treatment and HIPAA purposes, and by court direction.
Confidential nature of records: conditions under which records may be disclosed. KRS 210.235
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
shall be kept confidential and shall not be disclosed by any person, except insofar as: (1) The person identified or his guardian, if any, shall consent; or
Who it binds, in our words: Applications, requests for admission and release, certifications, records and reports of the Cabinet for Health and Family Services that identify a patient or former patient
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
KRS 214.625 limits disclosure of HIV test results to listed persons. KRS 214.181 has a parallel rule. KRS 214.995 sets penalties.
Consent for HIV tests: confidentiality of results. KRS 214.625(5)(c)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
No person who has obtained or has knowledge of a test result pursuant to this section shall disclose or be compelled to disclose the identity of any person upon whom a test is performed, or the results of the test in a manner which permits identification
Who it binds, in our words: Any person who has obtained or has knowledge of an HIV test result under this section
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
KRS 311.705 requires separate express consent before a direct-to-consumer genetic testing company discloses genetic data. KRS 304.12-085 on insurers was named in a lead but not opened.
Genetic Information Privacy Act: genetic testing, collection and use of genetic data. KRS 311.705(2)(b)2.
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Separate express consent for transferring or disclosing the consumer’s genetic data to any person other than the company’s vendors and service providers, or for using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses;
Who it binds, in our words: Direct-to-consumer genetic testing companies
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Level 1 rests on KRS 365.730, a suit for failing to destroy records that include medical information. KCDPA bars private suits. KRS 446.070 is a general statute that no health law cross-references, so it is not counted.
"Level" is the step on our rulebook's scale for this question. 0 means nothing beyond HIPAA. Higher means the law gives you more here.
Damages a court may award: None stated. KRS 365.730 allows a civil action to recover damages and an injunction.
Civil action for damages or injunction for violation of KRS 365.725 (records disposal). KRS 365.730(1)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Any customer injured by a violation of KRS 365.725 may institute a civil action to recover damages.
Who it binds, in our words: Businesses that dispose of customer records containing personally identifiable information
Definitions for KRS 365.720 to 365.730. KRS 365.720(4)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
driver identification number, personal identification card number or code, date of birth, medical information, financial information, tax information, and disability information
Who it binds, in our words: Personally identifiable information of a customer of a business; banks, credit unions and savings associations are excluded
Kentucky Consumer Data Protection Act: no private right of action. KRS 367.3627(4)
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
Nothing in KRS 367.3611 to 367.3629 or any other law, regulation, or the equivalent shall be construed as providing the basis for, or give rise to, a private right of action for violations of KRS 367.3611 to 367.3629.
Who it binds, in our words: KCDPA controllers and processors
Penalty no bar to civil recovery. KRS 446.070
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
A person injured by the violation of any statute may recover from the offender such damages as he sustained by reason of the violation, although a penalty or forfeiture is imposed for such violation.
Who it binds, in our words: Any statute; not tied by its own words to a health data law
Second check by a separate agent: confirmed.
Must you be told if health data leaks in a breach?
No. The breach notice law covers neither medical nor health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Definition lists SSN, driver's license and financial account numbers only. No AG notice; consumer reporting agencies are told if over 1,000 persons. HIPAA-covered persons are exempt outright under KRS 365.732(8).
Deadline to tell people: most expedient time possible and without unreasonable delay.
No duty found to tell the attorney general or a regulator.
Notification to affected persons of computer security breach. KRS 365.732
In force · effective · read October 3, 2026 · source(apps.legislature.ky.gov)
"Personally identifiable information" means an individual's first name or first initial and last name in combination with any one (1) or more of the following data elements, when the name or data element is not redacted: 1. Social Security number; 2. Driver's license number; or
Who it binds, in our words: Any person or business entity that conducts business in this state. Does not apply to persons subject to HIPAA or Gramm-Leach-Bliley, or to state and local agencies.
Second check by a separate agent: disputed, then settled by the authors on October 3, 2026.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
KRS 42.722 (2025 SB 4) covers state agency AI and does not name health care. 2026 HB 455, HB 641 and SB 175 on AI in therapy and health were not enacted. 2026 HB 176 on prior authorization has no AI terms.
How we searched (October 3, 2026): the official code search for artificial intelligence health care, artificial intelligence prior authorization, artificial intelligence utilization review, mental health chatbot, consequential decision. Agency pages checked: insurance.ky.gov, apps.legislature.ky.gov.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
91.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
85.6%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
11.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$60,183 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.4%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
5.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
12.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
